CVE-2020-8558: A security issue was discovered in kube-proxy which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug. Maintainer, please stabilize when ready.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=58d831db94fe3d5752d3a54e08d158c6f477d424 commit 58d831db94fe3d5752d3a54e08d158c6f477d424 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2020-07-11 17:36:54 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2020-07-11 17:44:29 +0000 sys-cluster/kubernetes: stable 1.16.11, 1.17.7 and 1.18.4 on amd64 Bug: https://bugs.gentoo.org/731800 Signed-off-by: William Hubbs <williamh@gentoo.org> sys-cluster/kubernetes/kubernetes-1.16.11.ebuild | 2 +- sys-cluster/kubernetes/kubernetes-1.17.7.ebuild | 2 +- sys-cluster/kubernetes/kubernetes-1.18.4.ebuild | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b4b92d0a9acab2111536710a237a05e381f521e9 commit b4b92d0a9acab2111536710a237a05e381f521e9 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2020-07-11 18:32:15 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2020-07-11 18:38:21 +0000 sys-cluster/kubernetes: remove vulnerable versions Bug: https://bugs.gentoo.org/731800 Signed-off-by: William Hubbs <williamh@gentoo.org> sys-cluster/kubernetes/Manifest | 10 --- sys-cluster/kubernetes/kubernetes-1.16.10.ebuild | 90 ------------------------ sys-cluster/kubernetes/kubernetes-1.16.8.ebuild | 90 ------------------------ sys-cluster/kubernetes/kubernetes-1.16.9.ebuild | 90 ------------------------ sys-cluster/kubernetes/kubernetes-1.17.4.ebuild | 90 ------------------------ sys-cluster/kubernetes/kubernetes-1.17.5.ebuild | 90 ------------------------ sys-cluster/kubernetes/kubernetes-1.17.6.ebuild | 90 ------------------------ sys-cluster/kubernetes/kubernetes-1.18.0.ebuild | 90 ------------------------ sys-cluster/kubernetes/kubernetes-1.18.1.ebuild | 90 ------------------------ sys-cluster/kubernetes/kubernetes-1.18.2.ebuild | 90 ------------------------ sys-cluster/kubernetes/kubernetes-1.18.3.ebuild | 90 ------------------------ 11 files changed, 910 deletions(-)
Thanks, William.
